How to write a search to append a header variable to all events from the same source?

[moaf13]

I have a header variable that I would like to attach to each event in a table.

Header variable, FY= 2017

table

bill | reason | FY
100 |restaurant | 2017
200 | gas | 2017
500 | water | 2017

\sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY]  |table bill reason FY

The search above does not append the column to all events, it only appends it to the first row.
Is there a search or function that allows me to append the variable to all the events.

FYI, when I do eval tempVari="test", it attaches it to all events, but it doesn't work when it's a variable.

[richgalloway · Accepted solution]

Try this

sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY] | filldown FY | table bill reason FY

[moaf13]

Thank you, that was exactly what i was looking for!

[niketn]

I am not sure whether I get your question right. But seems like you should look for eventstats command which appends a field to events returned by search. Refer to documentation below:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats

[moaf13]

i'm just trying to attach the variable that contains the year 2017 to all events. I'm not doing any calculation. the variable exist only in file header meaning it will only be in one event.